PT-2023-28880 · Croc · Croc

Matthias Gerstner · Published 2023-09-19 · Updated 2024-09-25 · CVE-2023-43619

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Croc versions through 9.6.5

Description An issue was discovered in Croc where a sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized keys file.

Recommendations For Croc versions through 9.6.5, update to version 9.6.16 or later to resolve the issue. As a temporary workaround, consider restricting the types of files that can be sent through Croc to minimize the risk of exploitation. Avoid using Croc to transfer executable content or sensitive files like .ssh/authorized keys until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-43619

GHSA-PPJH-XP5V-46WC

GO-2023-2073

Affected Products

Croc

References · 16

• 🔥 https://github.com/schollz/croc/issues/593 · Exploit
• 🔥 https://openwall.com/lists/oss-security/2023/09/08/2 · Exploit
• https://osv.dev/vulnerability/GO-2023-2073 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ppjh-xp5v-46wc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43619 · Security Note
• https://github.com/schollz/croc · Note
• https://github.com/schollz/croc/pull/697 · Note
• https://github.com/schollz/croc/commit/3f12f75fae2e844c555ec01eeba0b8474938e93a · Note
• https://t.me/cibsecurity/70781 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704448782312538143 · Twitter Post
• http://openwall.com/lists/oss-security/2023/09/21/5 · Note
• https://github.com/advisories/GHSA-ppjh-xp5v-46wc · Note
• https://twitter.com/CVEnew/status/1704373076832432562 · Twitter Post
• https://t.me/cvenotify/58357 · Telegram Post